Jak wstawić dane do tabeli SQL za pomocą C#, a także zaimplementować funkcję przesyłania?

Question

Poniżej znajduje się kod, nad którym pracuję, aby spróbować wstawić dane do mojej tabeli "ArtykułyTBL". Chcę również przesłać plik obrazu do komputera PC. Wcześniej pracowałem w Visual Studio tylko z formantami danych w moim pliku .aspx, aby wstawić dane, więc próba zrobienia tego w języku C# jest dla mnie nowością. Każda pomoc będzie naprawdę doceniona. Dzięki.

Otrzymuję komunikat o błędzie: Niepoprawna składnia w pobliżu "UploadedUserFiles".

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Web; 
using System.Web.UI; 
using System.Web.UI.WebControls; 
using System.IO; 
using System.Data; 
using System.Data.SqlClient; 
using System.Web.Configuration; 

public partial class _CopyOfSubmitArticle : System.Web.UI.Page 
{ 
protected void Page_Load(object sender, EventArgs e) 
{ 

} 

protected void uploadbutton_Click(object sender, EventArgs e) 
{ 
    string UpPath = Server.MapPath("~/UploadedUserFiles"); 

     int imgSize = FileUpload1.PostedFile.ContentLength; 
     string imgName = FileUpload1.FileName; 
     string imgPath = "UploadedUserFiles/" + imgName; 

     if (FileUpload1.PostedFile.ContentLength > 1000000) 
     { 
      Page.ClientScript.RegisterClientScriptBlock(typeof(Page), "Alert", "alert('File is too big')", true); 
     } 

     else 
     { 
      FileUpload1.SaveAs(Server.MapPath(imgPath)); 
      myinfo.Text = "file" + imgPath + "uploaded."; 
     } 



    String connectionString = WebConfigurationManager.ConnectionStrings["ConnectAntiFrack"].ConnectionString; 

    SqlConnection myConnection = new SqlConnection(connectionString); 

    myConnection.Open(); 

    string ArticleImg = "UploadedUserFiles/" + FileUpload1.FileName; 
    string ArticleTitle = ArticleTitleTextBox.Text; 
    string ArticleContent = ArticleContentTextBox.Text; 
    string ArticleType = ArticleTypeDropdown.Text.ToString(); 
    string ArticleAuthor = ArticleAuthorTextBox.Text.ToString(); 
    string ArticleBrief = ArticleBriefTextBox.Text; 
    string ArticleDateTime = DateTime.Now.ToShortTimeString(); 

    string query = "INSERT INTO ArticlesTBL (ArticleTitle, ArticleContent, ArticleType, ArticleImg, ArticleBrief, ArticleDateTime, ArticleAuthor, ArticlePublished, ArticleHomeDisplay, ArticleViews) VALUES (" + ArticleTitle +", " + ArticleContent +", "+ ArticleType +" " + ArticleImg +", "+ ArticleBrief +"," + ArticleDateTime + ", "+ ArticleAuthor +",'False', 'False', '0')"; 

    SqlCommand myCommand = new SqlCommand(query, myConnection); 

    myCommand.ExecuteNonQuery(); 

    //  myinfo.Text = "connection to db is made"; 
    myConnection.Close(); 

} 

Answer 1

Należy używać parametrów w zapytaniu, aby zapobiec atakom, jak gdyby ktoś wszedł '); drop table ArticlesTBL;--' jako jedną z wartości.

string query = "INSERT INTO ArticlesTBL (ArticleTitle, ArticleContent, ArticleType, ArticleImg, ArticleBrief, ArticleDateTime, ArticleAuthor, ArticlePublished, ArticleHomeDisplay, ArticleViews)"; 
query += " VALUES (@ArticleTitle, @ArticleContent, @ArticleType, @ArticleImg, @ArticleBrief, @ArticleDateTime, @ArticleAuthor, @ArticlePublished, @ArticleHomeDisplay, @ArticleViews)"; 

SqlCommand myCommand = new SqlCommand(query, myConnection); 
myCommand.Parameters.AddWithValue("@ArticleTitle", ArticleTitleTextBox.Text); 
myCommand.Parameters.AddWithValue("@ArticleContent", ArticleContentTextBox.Text); 
// ... other parameters 
myCommand.ExecuteNonQuery(); 

(xkcd)

Answer 2

using System; 
using System.Data; 
using System.Data.SqlClient; 

namespace InsertingData 
{ 
    class sqlinsertdata 
    { 
     static void Main(string[] args) 
     { 
      try 
      { 
      SqlConnection conn = new SqlConnection("Data source=USER-PC; Database=Emp123;User Id=sa;Password=sa123"); 
      conn.Open(); 
       SqlCommand cmd = new SqlCommand("insert into <Table Name>values(1,'nagendra',10000);",conn); 
       cmd.ExecuteNonQuery(); 
       Console.WriteLine("Inserting Data Successfully"); 
       conn.Close(); 
     } 
      catch(Exception e) 
      { 
       Console.WriteLine("Exception Occre while creating table:" + e.Message + "\t" + e.GetType()); 
      } 
      Console.ReadKey(); 

    } 
    } 
}